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REMARKS/ARGUMENTS 

Claims 1-27, and new claims 28 and 29 are pending in the application. 
Reconsideration is requested in view of the above amendments and the following 
remarks. 

1. The Drawing 

The Examiner has required that a drawing be submitted, asserting that the subject 
matter admits of illustration to facilitate an understanding of the invention. Applicant 
submits a proposed drawing herewith for consideration by the Examiner. Reconsideration 
and approval of the drawing is respectfully requested. 

2. The Section 101 Rejections Have Been Overcome. 

Claims 15-17 stand rejected under 35 U.S.C. 101 as being directed to non- 
statutory subject matter. This rejection is respectfully but strenuously traversed and 
reconsideration is requested in view of the above amendments. 

Claim 1 5 has been amended to recite " A computer storage component including 
software containing . . ." 

Claim 16 and 17 have been amended to recite "an article of manufacture 
comprising a computer storage media that implements code for securing, maintaining, 
monitoring and controlling. . 

For these reasons, in view of the above amendments, Applicant submits that the 
claims define patentable statutory subject matter and reconsideration and withdrawal of 
the rejection is accordingly requested. 
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3. The Section 102 Rejection of the Claims as Being Anticipated by Nachenberg 
Should be Withdrawn. 

Claims 1, 8, 11, 13, 16-19, 21, 23 and 25 stand rejected under 35 U.S.C. 102(b) as 
being anticipated by Nachenberg (US 6,02 1 ,5 1 0). This rejection is respectfully but 
strenuously traversed and reconsideration and a withdrawal of the rejection are hereby 
respectfully requested. 

The rejection set forth in the Office Action considers Nachenberg to disclose 
providing a hash code table of a client, said hash code table being provided for storing a 
plurality of files, citing to Nachenberg col. 2, lines 26-37, and considers the data base 
storing hashes of plurality of files to meet this. (Also citing col. 1 line 60 - col. 2, line 9). 
The rejection also considers Nachenberg to provide a client state code of a client and 
further considers that Nachenberg discloses comparing the client state code of the client 
to a said hash code table (citing, as a basis col. 4, lines 40-47). Nachenberg, at col. 4, 
lines 54-64, is relied on for an alleged teaching of generating an alert mechanism when a 
deviation threshold is reached based on a deviation between the hash code table values 
for the said client and said client state code. 

Applicant's present invention, as recited in the claims, is not anticipated by 
Nachenberg, nor is it taught or suggested. Applicant's invention relates to methods, 
apparatus and articles of manufacture for securing, maintaining, monitoring and 
controlling systems and networks. A secure hash code table is generated or derived and 
provides a base line for the network and the systems on the network. (See Applicant's 
published specification at par. [0013]) Applicant accomplishes this by utilizing a 
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comparison cycle, wherein one or more systems or components on the network transmits 
a client state code. The client state code is compared to the secure hash code table value. 
If the client state code does not deviate from the secure hash code table value, or, 
alternately, if the deviation is within certain acceptable ranges (e.g., where a modal hash 
is derived) then the base line may be considered to represent the acceptable client state 
and no further action needs to be taken. If deviation is uncovered (in any manner or by 
an amount deemed unacceptable) an alerting mechanism is triggered. 

In accordance with Applicant's specification, the claimed features are discussed, 
(see e.g., par. [0014] "one or more systems on the networks transmit a client state code", 
and see par. [0016] "a secure hash code table is comprised of secure client hash code 
values, and, as further described below, will provide a baseline for the system, and in 
turn, any networks, as . . .") 

Claim 1 has been amended to more particularly articulate the Applicant's present 
invention by reciting that the secure hash code table includes the hash codes for files on 
computers within the network that are to be secured and that the method further includes: 

transmitting across a network from clients located in the network a client 
state code; providing at least one server within the network assigned to 
recognize said client state code transmission, wherein said server 
maintains a baseline for said client, and wherein said baseline comprises 
said hash code table of a said client. 

Applicant's invention is not disclosed or suggested by Nachenberg. Nachenberg relates 

to a system and method for examining a file to determine whether a computer virus is 

present within the file. Nachenberg indicates that file examination for the first time 
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involves scanning the file with an antivirus module and that the antivirus scan is where 
the hash value for each scan sector is obtained. Applicant's invention, as discussed in the 
background section of the Applicant's specification is important for combating threats 
that disrupt the security of computers. 

Nachenberg's antivirus accelerator is recited to be provided to increase the speed 
of scanning computer files by antivirus software (col. 1, lines 9-11). However, 
Applicant's present invention has broad application to situations where internal activities, 
such as acts by a disgruntled employee or an improper selection is made which is 
inconsistent with the desired baseline as represented by the client state code in the 
Applicant's present invention. Therefore, it would appear according to Nachenberg that 
if a virus were not present, but rather, a file were deleted, the Nachenberg virus indicator 
would not return a virus, unlike Applicant's utilization of a client state code which would 
appear to detect that tampering — that is that a change to the client baseline was made. 
Nachenberg does not disclose or suggest this. In addition, claim 1 of Applicant's 
invention has been amended, as pointed out above to more particularly articulate and 
distinguish the present invention. Nachenberg fails to disclose or suggest the securing 
method of the Applicant's invention wherein a client state code of one or more clients is 
transmitted across a network and is received by at least one server. Claim 1 provides that 
the baseline comprises the hash code table of the client and is maintained by the server, 
and that the client state code is transmitted across a network by clients. Therefore, 
Applicant provides a system where baseline security for the system, including for the 
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clients on the network, may be maintained, monitored and controlled, as well as secured 
from incidences such as, for example, tampering or mismanagement. 

Claims 18 and 19 also have been amended to recite the feature "wherein said hash 
code table includes the hash codes for files on computers within the network that are to 
be secured." For the same reasons, claims 18 and 19 should be patentable. 

For these reasons, Applicant submits that Nachenberg fails to disclose or suggest 
the Applicant's present invention as recited in the pending claims. Accordingly, 
reconsideration and a withdrawal of the rejection is hereby respectfully requested. 
4. The 103(a) Rejection Over Nachenberg and Angelo Should be Withdrawn. 

Claims 2, 3, 6 and 20 stand rejected under 35 U.S.C. 103(a) as being unpatentable 
over Nachenberg as applied to claims 1 and 19, and further in view of Angelo (U.S. 
5,944,821). This rejection is respectfully but strenuously traversed and reconsideration 
and a withdrawal of the rejection are hereby respectfully requested. 

The rejection in the Office Action relies on the Nachenberg disclosure cited 
above. However, the rejection acknowledges that Nachenberg fails to disclose the hash 
code table being a secure hash code table. Angelo is relied on, therefore, for an alleged 
teaching of the use of a secure hash table (citing to col. 4, lines 27-40) with the 
contention that it would have been considered obvious to make a hash table of 
Nachenberg a secure hash table to provide an integrity assessment code. 

Applicant's invention as recited in claims 2, 3, 6 and 20 is not obvious in view of 
the cited references. First, for the same reasons set forth above as to why the Applicant's 
invention should be patentable over Nachenberg, even in view of the further combination 



13 



Application Serial No. 10/032,251 
Response dated: January 31, 2008 
Reply to Office Action of August 31, 2007 



E-2528 



of Angelo, the present invention is still not disclosed or suggested. Second, one looking 
to Nachenberg would not have been led to provide a secure hash table. Applicant desires 
to consider a secure client state code, whereas Nachenberg seeks accelerating antivirus 
program speed by apparently attempting to prescan and store certain prescan results. 

For the above reasons, Applicant submits that Nachenberg and Angelo fail to 
disclose or suggest Applicant's present invention. Accordingly, reconsideration and a 
withdrawal of the rejection is respectfully requested. 

5. The 103(a) Rejection of Claims 4, 5, 14, 15, and 26-27 Over Nachenberg 
(Alone or In Combination With Angelo) in Further View of Crockett (US 
5,619,644) Should be Withdrawn. 

Claims 4, 5, 14, 15 and 26-27 stand rejected under 35 U.S.C. 103(a) as being 
unpatentable over Nachenberg alone or combination with Angelo as applied to claims 2 
and 25 above in view of Crockett (US 5,619,644). This rejection is respectfully but 
strenuously traversed and reconsideration and withdrawal of the rejection is hereby 
respectfully requested. 

The Examiner in the Office Action acknowledges that Nachenberg fails to 
disclose grouping (considered in the rejection to be compiled) the secured system data 
file and extracting the modal hash value. The Examiner, however, though 
acknowledging that Nachenberg fails to disclose these features of Applicant's claimed 
method, considers that it would have been obvious to take an additional reference, 
namely Crockett, which is considered in the Office Action to teach grouping of files 
(citing to col. 3, line 59 - col. 4, line 22 of Crockett), as well as the interjection of official 
notice taken regarding extracting the modal hash value. The rejection is premised on the 
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theory that motivation to make the changes, that is to revise Nachenberg as well as 

Crockett to the extent that there is official notice regarding extracting the modal hash 

value, would be to do so to recover from a disaster and use the most common value 

among the group. First, the substance of the rejection does not appear to come from the 

references themselves, but rather, from Applicant's own disclosure, and should be 

withdrawn for that reason alone. 

Second, the rejection should be withdrawn for additional reasons. Applicant's 

invention, however, does not simply relate to a most common value among the group. 

The group of what? The references do not teach or suggest that. It is the Applicant's 

invention which seeks to secure clients within the network. The passage relied on in 

Crockett reads as follows: 

In another embodiment of the present invention, a data storage system co- 
ordinates failure information amongst system components associated with 
an error condition occurring in the data storage system, wherein the 
system components include software, hardware and microcode control 
structures. The system components include a host processor, and one or 
more storage controllers coupled to non-volatile storage devices for 
processing and storing record updates. The host processor runs 
applications that generate the record updates and transmit I/O operations 
to the one or more storage controllers for eventually storing the record 
updates on the non-volatile storage devises. The host processor further 
includes a data mover for reading the record updates from the one or more 
storage controllers and assembling the record updates into groups of self 
describing records for transmission to a remote storage system for disaster 
recovery purposes. When an error occurs, the data mover receives an 
error code from one of the system components indicating a type of error 
condition that occurred. In response, the data mover issues a state save 
command to those system components associated with the error condition 
for causing said associated system components to temporarily suspend 
processing record updates while collecting failure information. The 
failure information for each system component is correlated according to 
the state save command. The data mover includes a trace queue for 
storing failure information associated with the data mover, and a control 
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section for managing record updates read into the data mover. A plurality 
of buffers are provided in the data mover for storing the record updates 
and their associated headers. (Crockett col. 3, line 59 - col. 4, line 22.) 

To the extent the rejection relies on Crockett for an alleged teaching of "grouping files", 

what is actually referred to in Crockett is "assembling the record updates into groups of 

self describing records for transmission to a remote storage system for disaster recovery 

purposes". That passage does not teach, suggest or disclose setting and utilizing a modal 

hash value, that is, a hash value that is the most frequently occurring hash value for a 

number of files. Moreover, one reading Crockett would not learn to provide an 

association or correspondence in regard to a modal hash value, when the assemblage of 

updates into groups are deemed groups of "self describing records". The Crockett 

reference is not believed to disclose or provide a teaching of what Applicant recites as the 

invention in the claims at issue in this rejection, namely, 4, 5, 14, 15 and 26-27. As to 

official notice regarding "extracting the modal hash value" that does not appear anywhere 

in the cited references, but rather, is solely disclosed by the Applicant's own specification 

and invention. Moreover, Nachenberg relates to a disclosure of expediting virus 

determinations associated with "a digital computer to determine whether a computer virus 

is present in the file". Applicant's invention, as recited in the claims, is distinguishable 

over the cited references. Reconsideration and a withdrawal of the rejection is 

respectfully requested. 

6. The 103(a) Rejection of Claim 7 Should be Withdrawn. 

Claim 7 stands rejected under 35 U.S.C. 103(a) as being unpatentable over the 
modified Nachenberg and Angelo system as applied to claim 3 above, and further in view 
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of IEEE. This rejection is respectfully but strenuously traversed and reconsideration and 
a withdrawal of the rejection is hereby respectfully requested. 

The rejection in the Office Action with respect to claim 7 acknowledges that 
Nachenberg and Angelo fail to disclose using a baseline to generate the table. The 
rejection further considers IEEE to teach the use of a baseline and therefore be 
combinable with the other disclosures "to have an agreed upon product" (citing to page 
87 of IEEE). First, for the reasons set forth above, the Applicant's invention is not 
disclosed, nor is it taught or suggested, by Nachenberg or Angelo. Even if the further 
combination of IEEE is made, the present invention, as recited in claim 7, still should be 
patentable. 

Accordingly, reconsideration and a withdrawal of the rejection is hereby 
respectfully requested. 

7, The 103(a) Rejection of Claims 9 and 22 Over Nachenberg Should be 
Withdrawn. 

Claims 9 and 22 stand rejected under 35 U.S.C. 103(a) as being unpatentable over 
Nachenberg. This rejection is respectfully but strenuously traversed and reconsideration 
and a withdrawal of the rejection are hereby respectfully requested. 

The Examiner's rejection considers that Nachenberg fails to disclose logging the 
results of the comparison. However, official notice is taken that it would have been 
obvious to one of ordinary skill in the art to log Nachenberg's comparison results. 
Applicant submits that the failure in Nachenberg to disclose logging is consistent with the 
failure of Nachenberg to disclose the Applicant's present invention. Moreover, for the 
reasons set forth above and for these additional reasons claims 9 and 22 are not taught, 
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suggested or disclosed by Nachenberg. Nachenberg desires speed, and, as stated, desires 
not to consider files that it has already scanned. The logging, considered by the rejection 
to be an obvious enhancement to Nachenberg, would appear to be inconsistent with what 
Nachenberg is attempting to do. For these reasons, reconsideration and a withdrawal of 
the rejection is respectfully requested. 

8. The 103(a) Rejection of Claim 10 Over Nachenberg Should be Withdrawn, 

Claim 10 stands rejected under 35 U.S.C. 103(a) as being unpatentable over 
Nachenberg as applied to claim 1 above, and further in view of Adya et al. (US 
200201 88605). This rejection is respectfully but strenuously traversed and 
reconsideration and a withdrawal of the rejection is hereby respectfully requested. 

The Examiner's rejection considers that Nachenberg fails to disclose securing a 
client in lock down mode. The Examiner considers Adya et al. to teach this at paragraphs 
144-146. For the same reasons as set forth above, Applicant's invention is not obvious in 
view of Nachenberg even when the further combination with the Adya et al. reference is 
made. Reconsideration and a withdrawal of the rejection are hereby respectfully 
requested. 

9. The 103(a) Rejection of Claims 12 and 24 Over Nachenberg Should be 
Withdrawn. 

Claims 12 and 24 stand rejected under 35 U.S.C. 103(a) as being unpatentable 
over Nachenberg as applied to claims 1 and 19 above, and further in view of Pascucci et 
al. (US 5,463,735). This rejection is respectfully but strenuously traversed and 
reconsideration and a withdrawal of the rejection is hereby respectfully requested. 
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The Examiner admits that Nachenberg fails to disclose initiating an auto restore 
component. It would appear, first for the reasons set forth above, Applicant's invention is 
not obvious or anticipated by Nachenberg. However, for additional reasons, one viewing 
Nachenberg would not have been led to employ an auto restore feature since Nachenberg 
desires to indicate whether or not a virus is present. The restoring would not be indicated 
as to what to restore to since, according to Nachenberg, if a virus is not present many 
changes could have occurred without a virus being present. Therefore, a restore point 
would first have to be indicated and Nachenberg would not be able to provide that option 
nor would it teach or suggest it. Accordingly, Applicant's invention is distinguishable as 
pointed out above, and is further particularized in claims 12 and 24, in that the client state 
code provides the baseline and the hash code values represent a baseline so that clients on 
the network may be secured against intentional or unintentional file deletions or mishaps. 
For the above reasons, and for these additional reasons, Applicant's invention, as recited 
in claims 12 and 24 should be patentable and the 103(a) rejection withdrawn. 
10. The Double Patenting Rejection, 

Claims 1-3, 8-1 1 and 13-23 are provisionally rejected under the judicially created 
doctrine of obviousness-type double patenting in view of claims 1 1-15, 18, 20 and 22-24 
of copending Application No. 10/032,252 (now US 7,143,1 13). Applicant submits that 
the claims are not identical and must be considered in view of the amendments to the 
claims herein. Reconsideration is requested. However, if and when the double patenting 
rejection is the only rejection that remains Applicant will consider submitting a terminal 
disclaimer to overcome the rejection. 
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Applicant also notes the double patenting rejection with respect to claims 4-7, 12 
and 24 in view of the same application number in combination with Nachenberg, Angelo, 
Crockett, IEEE and Pascucci et al. as applied in the above claims. For the reasons set 
forth above this rejection is respectfully traversed and a withdrawal of the double 
patenting rejection is requested. 
NEW CLAIMS 28 AND 29: 

New claims 28 and 29 have been added to more particularly distinguish 
embodiments of the Applicant's present invention over the cited references. New claim 

28 relates to the Applicant's method for securing, maintaining, monitoring and controlling 
computer networks and clients located therein, where the client's within the network are 
identical clients and have client state codes which are identical to each other. Claim 29 
further particularizes the Applicant's present invention by reciting the method where the 
clients have particular files present thereon which are common to one or more clients. 
Therefore, according to this embodiment, as recited in new claim 29, the hash code table 
may include concatenated file names and hash codes stored therein. New claims 28 and 

29 are supported by the application, and no new matter has been introduced. (See e.g., 
par. [0018] of Applicants specification) Accordingly, for the reasons set forth above and 
for these additional reasons these cited references relied on in the Office Action 
rejections are not believed to teach, suggest or disclose the Applicant's present invention 
as defined by new claims 28 and 29. 
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CONCLUSION 

Applicant's invention is not taught, suggested or disclosed by the cited references 
relied on by the Examiner. Accordingly, Applicant's presently claimed invention should 
be patentable. 

If necessary, an appropriate extension of time to respond is respectfully requested. 
The Commissioner is authorized to charge any additional fees which may be 
required to Patent Office Deposit Account No. 05-0208. 
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